CVE-2021-29482

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
ulikunitz	xz	< 0.5.8

References

https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9bPatch, Third Party Advisory
https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27Third Party Advisory
https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9bPatch, Third Party Advisory
https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27Third Party Advisory

Timeline

Published: Apr 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294837.5ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through th CVE-2021-294846.8Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access CVE-2021-294858.8Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE)CVE-2021-294867.5cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data CVE-2021-294877.4octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit CVE-2021-294885.3SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function CVE-2021-294895.4Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not syste CVE-2021-294905.8Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to CVE-2021-294928.3Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versio CVE-2021-294938.8Kennnyshiwa-cogs contains cogs for Red Discordbot. An RCE exploit has been found in the Tickets module of kennnyshiwa-cogs. This exploit all CVE-2021-294957.5Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verifi CVE-2021-294997.5SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce pre